Breach Disclosure: Dubsmash

In February 2019, The Register reported on a trove of information dumps being sold on the dark web. This collection contained details from approximately 16 sources, one of them being Dubsmash, a video message application. The disclosed information contained 162 million rows of email address, username and PBKDF2 password hashes. The Dubsmash breach, along with others in The Register report, has been made available to the general public while other dumps have yet to be disclosed.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media.

Details

Dubsmash is number 4 out of the 16 breaches from The Register report that have been disclosed to the public this month. This disclosed breach contained 162 million rows of email address, username and PBKDF2 password hashes. Dubsmash announced this incident 3 days before The Register report. The company itself reported the following information as being compromised:

• Usernames
• Encrypted passwords
• Email addresses
• Birthdates
• Phone numbers
• Country/language information

The 3 additional fields on the user notice were not disclosed publicly. Dubsmash also noted that not all breached records contained this information.

Research: Researchers Use Fake Social Accounts to Influence NATO Troops during Exercise

NATO’s Strategic Communications Center of Excellence published a report on the effectiveness of social media as an attack vector during military exercises. The researchers were able to use fake Facebook and Instagram accounts to “instill undesirable behavior” among NATO troops participating in an exercise. A combination of strategies were used to target these troops, including fake Facebook pages and groups, targeted advertising, open source research via search engines and “suggested friends” features in order to glean information about the unit, their movements and compromising personal information. In total, the group spent $60 for fake accounts and advertising, which represents a low bar in terms of investment for malicious actors that want to abuse these social network features.

Recommendations

• Enable Impersonation detection for your organization to find potentially fake profiles that engage in tactics, techniques and procedures similar to this research
• Enable rules that contain wordlist matching of potentially sensitive project names or operations to detect leaks of this information to the Internet
• Perform security awareness training with employees or personnel to help combat these attacks

Details

This exercise was part of a larger military training engagement. The NATO Red Team wanted to see if they could influence troop operations and provide useful intelligence using only open source resources. The group attempted to answer three questions:

1. What can we find out about a military exercise just from open source data?
2. What can we find out about the participants from open source data?
3. Can we use all this data to influence the participants behavior against their given orders?

StratCom, along with NATO, published its findings from this exercise last week. Their target set were professional soldiers who have had training specifically on influence operations like this. Over four weeks, the NATO team used a combination of targeted advertisement, closed groups and pages promoting those closed groups to attack the military members. By the end of the exercise 150 soldiers were identified on these platforms, and information collected included battalion locations and troop movements. The researchers even managed to get the troops to leave assigned locations which was explicitly against their orders.

Malware Update: Coinhive Shutting Down

The in-browser cryptocurrency mining service Coinhive has announced a global shutdown of operations. The service is notorious for being used by cybercriminals to mine cryptocurrency without their victim’s knowledge. Hacked websites and malicious ads have been used by cybercriminals to point victim computers to the service as a way to illegally mine Monero. Monero is attractive for cybercriminals because it uses a blockchain ledger that prevents outside investigators from researching the source or destinations of a transaction. The website stated that mining Monero via browsers is no longer “economically viable”.

Recommendations

• This shutdown could open the floodgates for secondary or competing browser mining services to be used in place of Coinhive. Continuously monitor chatter related to cryptojacking post Coinhive-shutdown
• Install free ad-blocking browser extensions that continuously update their rules to prevent cryptojacking attacks

Details

Coinhive is an in browser cryptomining service that has existed since 2017. Although the intention of the website was to provide website owners a way to allow their users to provide cryptomining cycles as a donation, it has been abused immensely by cybercriminals via cryptojacking attacks. Cryptojacking is the unauthorized use of computers to perform cryptomining operations. Cybercriminals have used the Coinhive library to load javascript maliciously into compromised websites or through malicious ads.

Although Coinhive has been notorious for hosting malicious wallets and has tried to implement measures to authenticate and authorize mining operations from cryptominers, the model of mining via a piece of javascript is attractive for cybercriminals. The shutdown of this website will not kill this model and security organizations should be vigilant in tracking websites that offer similar services. XMR, the cryptocurrency associated with Monero & Coinhive, depreciated over 85% last year and Coinhive claims this development as the impetus to the shutdown.

Malware Update: Malspam Campaign Uncovered Abusing Latest WinRAR Vulnerability

Security researchers with 360 Threat Intelligence uncovered a malspam campaign spreading an exploit for the WinRAR path traversal vulnerability (CVE-2018-20250). The campaign itself came in an email with a malicious WinRAR archive. For the attack to be successful, it required UAC to be disabled or for the user to have administrative privileges.

Recommendations

• Update WinRAR to the latest version. While there is no patch for the vulnerability, the latest version of WinRAR has disabled the affected library. This means WinRAR will no longer support ACE or DLL
• Ensure UAC is turned on for your Windows environments

Details

The specific sample was caught by 360 Threat Intelligence. The vulnerability itself was found in in the UNACVE2.dll library (CVE-2018-20250) which abuses a path traversal vulnerability to drop a malicious file on the target system. The exploit requires user interaction to extract the WinRAR archive to issue the attack as well as a version of WinRAR that supports the ACE format. WinRAR has subsequently removed the affected DLL from their software.

VirusTotal link to Malware: https://www.virustotal.com/#/file/7871204f2832681c8ead96c9d509cd5874ed38bcfc6629cbc45472b9f388e09c/community

Proof of Concept code for vulnerability: https://github.com/Ridter/acefile

IOCs from 360 Threat Intelligence:

http://138[.]204.171.108/BxjL5iKld8.zip

138[.]204.171.108:443

MD5: 6c702c25ec425764a303418b2d3f99ae

SHA-1: ff5805c0afd569ab9a6346a844843083e39431de

SHA-256: 7871204f2832681c8ead96c9d509cd5874ed38bcfc6629cbc45472b9f388e09c